Free BCS Practitioner Certificate in Data Protection Exam PDP9 Exam Practice Test

A company based in France uses a specialist IT support business in China The two companies have signed a Data Processing Agreement. The Chinese business provides specialist IT support for the French company's digital customer experience platform No personal data is sent to China, but employees of the Chinese business access the platform on a regular basis and have access to the databases that sit behind it. Which of the following statements is CORRECT in relation to the French company's requirements to ensure compliance with the GDPR?

• No personal data is being transferred, therefore no transfer mechanism is needed
• The French company must identify and implement an appropriate transfer mechanism
• There is a Data Processing Agreement in place therefore no transfer mechanism is needed
• China provides an adequate level of protection for personal data, therefore no transfer mechanism is needed

Who is entitled to a private life by law in the UK?

• All individuals.
• All individuals save for Members of Parliament
• Private individuals who do not conduct their business on public platforms (such as professional sports people and actors
• Nobody

Which of the below would be the BEST example of processing that could utilise the Public Interest Task lawful basis?

• A health authority processing the personal information of its staff in order to record all training undertaken
• A debt collection agency processing information relating to unpaid fines for misuse of community council car parking.
• A local authority processing the personal information of the person responsible for paying council tax
• A tax authority drops cookies on the devices of visitors to its website

An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

• Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.
• While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request
• In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle
• This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.

Where are the definitions of "Public Authority" and "Public Bodies" found?

• Freedom of Information Act 2000 and Data Protection Act 2018
• GDPR and Data Protection Act 2018.
• Data Protection Act 2018 and PECR.
• Data Protection Act 2018 only

How are data sharing practices governed by data protection law?

• Data sharing practices are covered in the DPA 2018, supported by a statutory Code of Practice that provides specific guidance
• Data sharing practices are subject to the PECR until the new statutory Code of Practice is published
• Data sharing practices are covered by the Freedom of Information Act
• Data sharing practices are not specifically regulated, however the ICO provide best practice guidance

What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?

• Education data, examination scripts and marks
• Credit checking agency data
• Social Work Data.
• Health data

What is the meaning of storage limitation in relation to UK GDPR Article 5 (1 )(e)?

• Keeping identifiable personal data for no longer than is necessary for the intended processing
• Storing data in a secure format only permitting access to those with a business need
• Only storing data in locations within the EU. except where there is an adequacy decision.
• Limiting the number of records stored in any single repository to minimise risk surface.

In the terms of their relevance under data protection legislation, how can CCTV images recorded in a supermarket BEST be described'?

• They are special category data as they identify special characteristics
• They are biometric data in the terms of the definition stipulated in the GDPR.
• The GDPR is only engaged where these are accompanied by text or other identifier
• They are personal data as they can be used to identify living human beings

Under which circumstances can the 'domestic purposes' exemption be used to justify non- compliance with the Data Protection Act 2018?An individual sells make up products for commission and uses social media to promote products to friends and familyA couple are planning their daughter's wedding and use excel to store contact details and dietary needs of the guestsAn individual employs a babysitter and stores her bank details in an encrypted document in order to make paymentsA pansh council keeps a spreadsheet to manage bookings of the village hall, it contains only contact information and time slotsA group of students are arranging a house party and using social media to invite people that they do and do not knowA, B, C, and E.B. C. D, and EB, and C

• B.C. and D